CanCanCan VS Action Policy

https://github.com/CanCanCommunity/cancancan (Ruby on Rails ABAC) Same like casl.js, but for Ruby on Rails! Casl.js was actually inspired and modeled by cancancan.

For authorization, I'm going back and forth with Pundit and CanCanCan

This code mounts the Flipper UI at the /flipper endpoint in your application. The RoleConstraint class is used to restrict access to the UI to users who have the manage role. You can customize this constraint to suit your specific needs. In this case, we're using the CanCanCan gem to gate specific routes to admin users. If you haven't worked with CanCanCan before, ignore the RoleConstraint portion.

Would you do : 1. a roles table with the name of the role and 64 booleans? 2. A roles table with one JSON field? (using rails json data type) 3. A roles table and a permissions table, similar do what is suggested in the cancancan developpers guide:

Expressing authorization rules can be a bit challenging with the use of other authorization gems, such as pundit or cancancan. The resource_policy gem provides a more concise and expressive policy definition that uses a simple block-based syntax that makes it easy to understand and write authorization rules for each attribute.

https://github.com/CanCanCommunity/cancancan (Ruby on Rails ABAC) Same like casl.js, but for Ruby on Rails! Casl.js was actually inspired and modeled by cancancan.

In production code you would most likely use a library for access control, such as CanCanCan

PS If you do mobile / web work (or something else with "detached" UI), I find that declarative access control rules are far superior to imperative ones, because they can be serialized and shipped over the wire. For example, backend running cancancan can be easily send the same rules to casl on the frontend, while if you used something like pundit to secure your backend, you either end up re-implementing it in the frontend, or sending ton of "canEdit" flags with every record.

You can use a gem like cancancan (https://github.com/CanCanCommunity/cancancan )to manage authorization, and its helpers to show stuff based on what a user can do

Action Policy is a flexible, extensible, and performant authorization framework for Ruby and Rails apps. It uses multiple caching strategies out of the box, making it very fast, especially if your authorization rules require database queries.

Action Policy is the latest Authorization framework I've seen recommended. What is more, it is maintained by the nice and experienced team from Evil Martians.

Lots of goodies here, such as token authentication, role- and permission-based authorization (including a move from Pundit to ActionPolicy), and how I test the API end-to-end using *raises flame shield* Cucumber.

Also, ActionPolicy is better than Pundit for most applications. Give it a try.

Use Action Policy or Pundit, and write tests for your policies. Authz is worth testing with near complete coverage.

You may ask what's makes Active Entry better or different from other gems like Pundit, Action Policy (especially), or CanCanCan.

At work, we've recently faced similar issues and moved to ActionPolicy as a result. It's designed slightly differently, but there is a lot of overlap with what John came up with.